With development of computers and network technologies, systems providing various services for users emerge, including, for example, cloud computing systems that provide applications, data and IT services for users. In such systems, to ensure security of stored static data and generated dynamic data, it is necessary to encrypt the data with an encryption algorithm. For example, in a cloud computing environment, two data encryption modes are typically used: a first encryption mode based on certificate authentication and a second encryption mode based on cloud computing key management.
The basic principle of the certificate-based encryption authentication mode is as follows: a server in the system controls and saves keys by itself; when encrypting and storing the static data, the server uses symmetric keys to encrypt the data, and then uses a digital certificate to encrypt the symmetric keys (i.e., using a public key to encrypt the symmetric keys) and stores the encrypted data; when reading the data, the server or another server first uses a private key to decrypt the symmetric keys and then uses the decrypted symmetric keys to decrypt the data.
Compared with the certificate-based encryption authentication mode, the encryption mode that uses a cloud computing key management system is more widely applied to cloud computing environments, and is also the foundation of the security of cloud data.
FIG. 1 is an exemplary cloud computing key management system. The cloud computing key management system includes two parts, i.e., a cloud computing key client end and a cloud computing key management service end. The cloud computing key client end resides in a cloud computing server and is responsible for providing a key service for cloud computing applications in the cloud computing server. The cloud computing key client end uses a standard key management protocol to apply for management services such as key generation, key recovery and key update to the cloud computing key management service end. The cloud computing key management service end applies for corresponding services to a symmetric password management server according to a service application type, and then returns a key service operation result to the cloud computing key client end, and may also act on behalf of the cloud computing key client end to apply for the corresponding services to a digital certificate center.
Because both modes use classical cryptography based on computational complexity, they can potentially be cracked in light of the emergence of cloud computing, quantum computing, and other computing technologies. In addition, for the first mode, the encrypted key must be kept safe. Once lost or damaged, the key or data cannot be recovered. For the second mode, although handing over the key to the system for central management improves security, administrators of the key management server, who have higher operation permissions, can access user data and keys, may give away the keys and user confidential information.